mustflow 2.108.0 → 2.108.3

package/README.md

@@ -309,6 +309,9 @@ mf run mustflow_update_apply
 | `mf script-pack run code/export-diff compare --base HEAD --json` | Compare exported TypeScript or JavaScript declarations, return metadata, and package surface hints against a git base. |
 | `mf script-pack run docs/reference-drift check [path...] --json` | Check documentation references to `mf` commands, script-pack refs, schema files, and repository paths against current local surfaces. |
 | `mf script-pack run repo/config-chain inspect <path...> --json` | Inspect nearby package, TypeScript, ESLint, Vite, Tailwind, test, and mustflow config files plus static inheritance edges without executing dynamic config code. |
+| `mf script-pack run repo/toolchain-provenance inspect --json` | Inspect repository-visible runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running those tools. |
+| `mf script-pack run repo/automation-surface inspect --json` | Inventory package scripts, task runners, CI workflows, and mustflow command-intent coverage before adopting automation advice. |
+| `mf script-pack run repo/dependency-surface inspect --json` | Inspect dependency manifests, lockfiles, update automation, and policy surfaces without installing or updating packages. |
 | `mf script-pack run repo/env-contract scan [path...] --json` | Scan code, CI, docs, config, and env examples for environment-variable contract drift without reading or printing real secret env values. |
 | `mf script-pack run repo/secret-risk-scan scan [path...] --json` | Scan code, docs, config, CI, and examples for plausible hardcoded secrets while reporting only redacted fingerprints. |
 | `mf script-pack run repo/generated-boundary check <path...> --json` | Check whether candidate paths cross generated, ignored, protected, vendor, or cache boundaries before or after edits. |

package/dist/cli/commands/api/serve.js

@@ -1,10 +1,10 @@
-import { createInterface } from 'node:readline';
 import { apiReportActionSpec, isApiReportAction } from './actions.js';
 import { printUsageError } from '../../lib/cli-output.js';
 import { formatCliOptionParseError, hasParsedCliOption, parseCliOptions, } from '../../lib/option-parser.js';
 import { isRecord } from '../../lib/command-contract.js';
 import { t } from '../../lib/i18n.js';
 const API_SERVE_SCHEMA_VERSION = '1';
+const API_SERVE_MAX_LINE_CHARS = 1024 * 1024;
 const API_SERVE_OPTIONS = [
     { name: '--stdio', kind: 'boolean' },
     { name: '--help', kind: 'boolean', aliases: ['-h'] },
@@ -53,6 +53,15 @@ function readApiServeId(request) {
     }
     return null;
 }
+function readApiServeChanged(request, id) {
+    if (!Object.hasOwn(request, 'changed')) {
+        return undefined;
+    }
+    if (typeof request.changed === 'boolean') {
+        return request.changed;
+    }
+    return createApiServeError(id, 'invalid_request', 'Request field "changed" must be a boolean when provided.');
+}
 function parseApiServeRequestLine(line) {
     let parsed;
     try {
@@ -72,11 +81,18 @@ function parseApiServeRequestLine(line) {
             error: createApiServeError(id, 'invalid_request', 'Request must be a JSON object.'),
         };
     }
+    const changed = readApiServeChanged(parsed, id);
+    if (typeof changed !== 'boolean' && changed !== undefined) {
+        return {
+            request: null,
+            error: changed,
+        };
+    }
     return {
         request: {
             id,
             action: parsed.action,
-            changed: parsed.changed,
+            changed,
         },
         error: null,
     };
@@ -99,8 +115,8 @@ function createApiServeResponse(request, runtime) {
     try {
         return createApiServeSuccess(id, runtime.createReport(request.action));
     }
-    catch (error) {
-        return createApiServeError(id, 'report_unavailable', error instanceof Error ? error.message : String(error));
+    catch {
+        return createApiServeError(id, 'report_unavailable', 'Report is unavailable for this action.');
     }
 }
 function writeApiServeResponse(response, reporter) {
@@ -111,6 +127,53 @@ function writeApiServeResponse(response, reporter) {
     }
     reporter.stdout(line.trimEnd());
 }
+async function* readApiServeInputLines(input) {
+    input.setEncoding('utf8');
+    let buffer = '';
+    let discardingOversizedLine = false;
+    for await (const chunk of input) {
+        const text = typeof chunk === 'string' ? chunk : String(chunk);
+        let start = 0;
+        while (start < text.length) {
+            const newlineIndex = text.indexOf('\n', start);
+            const segmentEnd = newlineIndex === -1 ? text.length : newlineIndex;
+            const segment = text.slice(start, segmentEnd);
+            if (discardingOversizedLine) {
+                if (newlineIndex !== -1) {
+                    yield { oversized: true };
+                    discardingOversizedLine = false;
+                }
+            }
+            else if (buffer.length + segment.length > API_SERVE_MAX_LINE_CHARS) {
+                buffer = '';
+                if (newlineIndex === -1) {
+                    discardingOversizedLine = true;
+                }
+                else {
+                    yield { oversized: true };
+                }
+            }
+            else {
+                buffer += segment;
+                if (newlineIndex !== -1) {
+                    yield { line: buffer.endsWith('\r') ? buffer.slice(0, -1) : buffer };
+                    buffer = '';
+                }
+            }
+            if (newlineIndex === -1) {
+                break;
+            }
+            start = newlineIndex + 1;
+        }
+    }
+    if (discardingOversizedLine) {
+        yield { oversized: true };
+        return;
+    }
+    if (buffer.length > 0) {
+        yield { line: buffer.endsWith('\r') ? buffer.slice(0, -1) : buffer };
+    }
+}
 export async function runApiServe(args, reporter, lang, runtime) {
     const parsed = parseCliOptions(args, API_SERVE_OPTIONS);
     if (hasParsedCliOption(parsed, '--help')) {
@@ -125,12 +188,12 @@ export async function runApiServe(args, reporter, lang, runtime) {
         printUsageError(reporter, t(lang, 'api.error.serveRequiresStdio'), 'mf api --help', runtime.getHelp(lang), lang);
         return 1;
     }
-    const input = createInterface({
-        input: process.stdin,
-        crlfDelay: Infinity,
-    });
-    for await (const rawLine of input) {
-        const line = rawLine.trim();
+    for await (const inputLine of readApiServeInputLines(process.stdin)) {
+        if (inputLine.oversized) {
+            writeApiServeResponse(createApiServeError(null, 'request_too_large', `Request line exceeds ${API_SERVE_MAX_LINE_CHARS} characters.`), reporter);
+            continue;
+        }
+        const line = inputLine.line?.trim() ?? '';
         if (line.length === 0) {
             continue;
         }

package/dist/cli/commands/script-pack.js

@@ -75,6 +75,9 @@ export function getScriptPackHelp(lang = 'en') {
             'mf script-pack run test/performance-report summarize --json',
             'mf script-pack run test/regression-selector select --base HEAD --json',
             'mf script-pack run repo/config-chain inspect src/cli/index.ts --json',
+            'mf script-pack run repo/toolchain-provenance inspect --json',
+            'mf script-pack run repo/automation-surface inspect --json',
+            'mf script-pack run repo/dependency-surface inspect --json',
             'mf script-pack run repo/env-contract scan --json',
             'mf script-pack run repo/secret-risk-scan scan src README.md --json',
             'mf script-pack run repo/security-pattern-scan scan src .github/workflows --json',

package/dist/cli/i18n/en.js

@@ -806,6 +806,9 @@ Read these files before working:
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -1189,6 +1192,40 @@ Read these files before working:
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/i18n/es.js

@@ -806,6 +806,9 @@ Lee estos archivos antes de trabajar:
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -1189,6 +1192,40 @@ Lee estos archivos antes de trabajar:
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/i18n/fr.js

@@ -806,6 +806,9 @@ Lisez ces fichiers avant de travailler :
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -1189,6 +1192,40 @@ Lisez ces fichiers avant de travailler :
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/i18n/hi.js

@@ -806,6 +806,9 @@ export const hiMessages = {
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -1189,6 +1192,40 @@ export const hiMessages = {
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/i18n/ko.js

@@ -806,6 +806,9 @@ export const koMessages = {
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "작업",
     "scriptPack.label.schema": "스키마",
@@ -1189,6 +1192,40 @@ export const koMessages = {
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/i18n/zh.js

@@ -806,6 +806,9 @@ export const zhMessages = {
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -1189,6 +1192,40 @@ export const zhMessages = {
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/lib/command-registry.js

@@ -169,6 +169,9 @@ export const COMMAND_DEFINITIONS = [
             'repo-manifest-lock-drift-report',
             'skill-route-audit-report',
             'repo-version-source-report',
+            'repo-toolchain-provenance-report',
+            'repo-automation-surface-report',
+            'repo-dependency-surface-report',
             'repo-approval-gate-report',
             'repo-deploy-surface-report',
             'config-chain-report',

package/dist/cli/lib/script-pack-registry.js

@@ -436,6 +436,90 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'config-chain-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/repo-config-chain.js')).runRepoConfigChainScript,
             },
+            {
+                packId: 'repo',
+                id: 'toolchain-provenance',
+                ref: scriptRef('repo', 'toolchain-provenance'),
+                usage: 'mf script-pack run repo/toolchain-provenance inspect [options]',
+                summaryKey: 'scriptPack.script.toolchainProvenance.summary',
+                actions: ['inspect'],
+                useWhen: [
+                    'Inspect repository runtime, package-manager, lockfile, Docker, and CI version contract sources before debugging local environment drift.',
+                    'Review toolchain provenance when package metadata, CI, Docker, setup, bootstrap, or doctor automation changes.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: [],
+                outputs: ['human_summary', 'json_report', 'toolchain_sources', 'lockfiles', 'toolchain_findings'],
+                relatedSkills: [
+                    'command-intent-mapping-gate',
+                    'config-env-change',
+                    'dependency-reality-check',
+                    'version-freshness-check',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'repo-toolchain-provenance-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-toolchain-provenance.js')).runRepoToolchainProvenanceScript,
+            },
+            {
+                packId: 'repo',
+                id: 'automation-surface',
+                ref: scriptRef('repo', 'automation-surface'),
+                usage: 'mf script-pack run repo/automation-surface inspect [options]',
+                summaryKey: 'scriptPack.script.automationSurface.summary',
+                actions: ['inspect'],
+                useWhen: [
+                    'Inventory package scripts, task runners, CI workflows, and mustflow command intents before mapping external automation advice to safe actions.',
+                    'Review raw automation surfaces, long-running commands, release/deploy scripts, and missing command-contract coverage.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: [],
+                outputs: ['human_summary', 'json_report', 'automation_surfaces', 'automation_findings'],
+                relatedSkills: [
+                    'command-intent-mapping-gate',
+                    'completion-evidence-gate',
+                    'proactive-risk-surfacing',
+                    'release-publish-change',
+                ],
+                riskLevel: 'medium',
+                cost: 'low',
+                reportSchemaFile: 'repo-automation-surface-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-automation-surface.js')).runRepoAutomationSurfaceScript,
+            },
+            {
+                packId: 'repo',
+                id: 'dependency-surface',
+                ref: scriptRef('repo', 'dependency-surface'),
+                usage: 'mf script-pack run repo/dependency-surface inspect [options]',
+                summaryKey: 'scriptPack.script.dependencySurface.summary',
+                actions: ['inspect'],
+                useWhen: [
+                    'Inspect dependency manifests, lockfiles, update-bot config, audit, license, and SBOM surfaces before dependency automation work.',
+                    'Review package-manager lockfile conflicts, missing update automation, and missing dependency policy evidence.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: [],
+                outputs: ['human_summary', 'json_report', 'dependency_surfaces', 'dependency_findings'],
+                relatedSkills: [
+                    'dependency-reality-check',
+                    'dependency-upgrade-review',
+                    'provenance-license-gate',
+                    'public-json-contract-change',
+                ],
+                riskLevel: 'medium',
+                cost: 'low',
+                reportSchemaFile: 'repo-dependency-surface-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-dependency-surface.js')).runRepoDependencySurfaceScript,
+            },
             {
                 packId: 'repo',
                 id: 'env-contract',